Manage a security operations environment →easyMultiple ChoiceObjective-mapped

SC-200 Manage a security operations environment Practice Question

Exhibit

Refer to the exhibit.

KQL query:

SecurityAlert
| where TimeGenerated > ago(7d)
| summarize TotalAlerts = count() by AlertSeverity
| order by AlertSeverity desc

Refer to the exhibit. You run this KQL query in Microsoft Sentinel. What is the purpose of the query?

⚠ Common exam trap

The SC-200 exam often tests the distinction between the `SecurityAlert` table (alerts) and the `SecurityIncident` table (incidents), and candidates mistakenly interpret any time-filtered count query as 'listing incidents' or 'finding the most recent alert' without recognizing the aggregation and projection logic.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

To count alerts by severity over the last week

The KQL query uses the `SecurityAlert` table and summarizes alerts by `AlertSeverity` using the `count()` aggregation function. The `where TimeGenerated > ago(7d)` filter restricts results to the last 7 days, and the `project` clause outputs only the severity and count columns. This directly produces a count of alerts grouped by severity over the last week, matching option B.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
To list all incidents in the last 7 days
Why it's wrong here
This query reads from the SecurityAlert table, which stores individual alerts generated by analytic rules, not incidents. Incidents are aggregated records in the SecurityIncident table, so this query could never list incidents regardless of the time filter. Moreover, even if it targeted alerts, the summarize operator collapses rows into counts rather than returning a list.
✓
To count alerts by severity over the last week
Why this is correct
The query filters SecurityAlert records to the last seven days using the TimeGenerated field and then uses summarize to count rows grouped by AlertSeverity, returning one row per severity value with a count. This directly answers how many low, medium, high, and informational alerts occurred in that window. It is the intended purpose of this KQL statement.
✗
To find the most recent high-severity alert
Why it's wrong here
To return the most recent high-severity alert, you would need to either filter by AlertSeverity == 'High' and sort TimeGenerated descending while taking the first record, or use arg_max(TimeGenerated, *). This query instead groups all severities and only produces aggregated counts per severity bucket, so it loses the individual alert details and does not highlight the latest occurrence.
✗
To identify hunting results
Why it's wrong here
Hunting queries in Microsoft Sentinel are designed to proactively search for threats and typically leverage tables like Hunting, or use specialized operators to investigate anomalies over larger datasets. This query is a straightforward alert normalization/reporting operation on SecurityAlert, not an exploratory hunting query, and it does not produce results that indicate a specific threat hunt or identify suspicious entities.

Go deeper

SC-200 Manage a security operations environment Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question